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1 . A network system comprising: 
links; 

end stations coupled between the links, wherein types of end stations 
include endnodes which originate or consume frames and routing devices which 
route frames between the links, wherein at least one end station includes: 

an access control filter configured to restrict routes of frames 

from at least one end station on a selected routing path based on a 

selected frame header field. 

2. The network system of claim 1 wherein the at least one end station 
having the access control filter includes at least one routing device. 

3 . The network system of claim 2 wherein the at least routing device having 
the access control filter includes at least one switch. 

4. The network system of claim 2 wherein the at least routing device having 
the access control filter includes at least one router. 

5. The network system of claim 1 wherein the at least one end station 
having the access control filter includes at least one endnode. 

6. The network system of claim 1 wherein the at least one endnode having 
the access control filter includes at least one processor endnode. 

7. The network system of claim 6 wherein the at least one processor 
endnode includes a network interface controller which includes the access 
control filter. 

8. The network system of claim 1 wherein the at least one endnode having 
the access control filter includes at least one input/output (I/O) adapter endnode. 
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9. The network system of claim 8 wherein the at least I/O adapter endnode 
includes an I/O adapter which includes the access control filter. 

10. The network system of claim 1 wherein the access control filter in the at 
least one end station is implemented in hardware. 

in 11. The network system of claim 1 wherein the selected frame header field 

comprises a next header field. 

12. The network system of claim 1 1 wherein the access control filter restricts 
M ; selected frame types indicated in the next header field from entering selected 

jijj routes. 

fft 1 3 . The network system of claim 1 1 wherein the access control filter restricts 

H raw datagram frames indicated in the next header field from entering selected 

* routes. 

14. The network system of claim 1 wherein the selected frame header field 
O comprises an opcode field. 

ru 

15. The network system of claim 14 wherein the access control filter restricts 
routes of frames based on a type of operation being attempted as indicated in the 
opcode field. 

16. The network system of claim 1 5 wherein the type of operation being 
attempted is a management operation. 

1 7. The network system of claim 1 5 wherein the type of operation being 
attempted is a data operation. 

18. The network system of claim 1 5 wherein the type of operation being 
attempted is a route update operation. 
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19. An end station configured to operated in a network system having end 
stations coupled between links, the end station comprising: 

an access control filter configured to restrict routes of frames from at 
least one end station on a selected routing path based on a selected frame header 
field. 

20. The end station of claim 1 9 wherein the end station is a routing device 
which routes frames between the links. 

21 . The end station of claim 20 wherein the routing device comprises a 
switch. 

22. The end station of claim 20 wherein the routing device comprises a 
router. 

23 . The end station of claim 1 9 wherein the end station is an endnode which 
originates or consumes frames. 

24. The end station of claim 23 wherein the endnode is a processor endnode. 

25. The end station of claim 24 wherein the processor endnode includes a 
network interface controller which includes the access control filter. 

26. The end station of claim 23 wherein the endnode is an input/output (I/O) 
adapter endnode. 

27. The end station of claim 26 wherein the I/O adapter endnode includes an 
I/O adapter which includes the access control filter. 

28. The end station of claim 1 9 comprising hardware which implements the 
access control filter. 
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29. The end station of claim 1 9 wherein the selected frame header field 
comprises a next header field. 

30. The end station of claim 29 wherein the access control filter restricts 
selected frame types indicated in the next header field from entering selected 
routes. 

3 1 . The end station of claim 29 wherein the access control filter restricts raw 
datagram frames indicated in the next header field from entering selected routes. 

32. The end station of claim 1 9 wherein the selected frame header field 
comprises an opcode field. 

33. The end station of claim 32 wherein the access control filter restricts 
routes of frames based on a type of operation being attempted as indicated in the 



34. The end station of claim 33 wherein the type of operation being 
attempted is a management operation. 

35. The end station of claim 33 wherein the type of operation being 
attempted is a data operation. 

36. The end station of claim 33 wherein the type of operation being 
attempted is a route update operation. 

37. A routing device configured to route frames between the links in a 
network system, the routing device comprising: 

an access control filter configured to restrict routes of frames from at 
least one end station on a selected routing path based on a selected frame header 
field. 
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38. The routing device of 37 wherein the routing device comprises a switch 
having the access control filter. 

39. The routing device of claim 37 wherein the routing device comprises a 
router having the access control filter. 

40. The routing device of claim 37 wherein the selected frame header field 
comprises a next header field. 

41 . The routing device of claim 37 wherein the selected frame header field 
comprises an opcode field. 

42. An endnode configured to originates or consumes frames in a network 
system, the endnode comprising: 

an access control filter configured to restrict routes of frames from at 
least one end station on a selected routing path based on a selected frame header 
field. 

43 . The endnode of claim 42 wherein the endnode is a processor endnode. 

44. The endnode of claim 43 wherein the processor endnode includes a 
network interface controller which includes the access control filter. 

45. The endnode of claim 42 wherein the endnode is an input/output (I/O) 
adapter endnode. 

46. The endnode of claim 45 wherein the I/O adapter endnode includes an 
I/O adapter which includes the access control filter. 

47. The endnode of claim 42 wherein the selected frame header field 
comprises a next header field. 
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48. The endnode of claim 42 wherein the selected frame header field 
comprises an opcode field. 

49. A method of controlling access in a network system having links and end 
stations coupled between the links, wherein types of end stations include 
endnodes which originate or consume frames and routing devices which route 
frames between the links, wherein the method comprises: 

restricting routes of frames from at least one end station on a selected 
routing path based on a selected frame header field. 

p 50. The method of claim 49 wherein the restricting includes restricting routes 

© of frames from or through at least one routing device. 

m 
Z 

51. The method of claim 49 wherein the restricting includes restricting routes 

* of frames from or through at least one switch. 

O 

w 

tZ 52. The method of claim 49 wherein the restricting includes restricting routes 

; . 

P of frames from or through at least one router. 

ru 

53 . The method of claim 49 wherein the restricting includes restricting routes 
of frames from or through at least one endnode. 



54. The method of claim 49 wherein the restricting includes restricting routes 
of frames from or through at least one processor endnode. 

55. The method of claim 54 wherein the restricting is performed by a 
network interface controller. 



56. The method of claim 49 wherein the restricting includes restricting routes 
of frames from or through at least one input/output (I/O) adapter endnode. 
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57. The method of claim 56 wherein the restricting is performed by an I/O 
adapter. 

58. The method of claim 49 wherein the restricting is performed by 
hardware. 

59. The method of claim wherein the selected frame header field comprises a 
next header field. 

60. The method of claim 59 wherein the restricting includes restricting 
y, selected frame types indicated in the next header field from entering selected 
p routes. 

s 

® 

pi; 61 . The method of claim 59 wherein the restricting includes restricting raw 

J*j datagram frames indicated in the next header field from entering selected routes. 

* 

O 

yj 62. The method of claim 1 wherein the selected frame header field comprises 

f 4 an opcode field. 

y ii 
C 
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63. The method of claim 62 wherein the restricting includes restricting routes 
of frames based on a type of operation being attempted as indicated in the 
opcode field. 

64. The method of claim 63 wherein the type of operation being attempted is 
a management operation. 

65. The method of claim 63 wherein the type of operation being attempted is 
a data operation. 

66. The method of claim 63 wherein the type of operation being attempted is 
a route update operation. 
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